Data-driven software-defined security

毫无疑问，企业和金融机构不断受到安全威胁，这不仅会造成数十亿美元的损失和恢复，而且还会影响他们的声誉。僵尸网络辅助攻击是对这些组织的众所周知的威胁。根据美国联邦调查局的数据，僵尸网络已经给美国受害者造成了超过90亿美元的损失，在全球造成了超过1100亿美元的损失。全球每年约有5亿台计算机受到感染，相当于每秒18名受害者。因此，必须保护这些组织免受僵尸网络辅助攻击。在这个项目中，我们的目标是设计一个自适应和强大的僵尸网络检测和缓解系统，利用机器学习（ML）。我们提出了新型的基于异常的入侵检测，同时采用基于主机和基于网络的检测方法。每种方法在检测一些基本的机器人行为方面都很强大。因此，我们的混合检测将利用底层方法的优势来构建一个机器人无法轻易逃避的高级检测系统。该系统将分别利用增量学习和对抗学习，使ML模型适应网络动态和对抗活动。一旦检测到入侵，系统将利用软件定义网络（SDN）来动态调整网络的监控和监视，并发起根本原因分析。该系统将自动生成将通过SDN执行的缓解工作流程，以确保网络及其数据的完整性。拟议的项目将扩大僵尸网络检测和缓解的范围，包括对零日威胁的保护。与行业合作伙伴加拿大皇家银行（RBC）合作取得的进展将对加拿大企业和金融机构网络安全的设计原则和实践产生持久的影响。

Undoubtedly, businesses and financial institutions are constantly under security threats, which not only costs billions of dollars in damage and recovery, it also detrimentally affects their reputation. A botnet-assisted attack is a widely known threat to these organizations. According to the U.S. Federal Bureau of Investigation, Botnets have caused over $9 billion in losses to U.S. victims and over $110 billion in losses globally. Approximately 500 million computers are infected globally each year, translating into 18 victims per second. Thus, it is imperative to defend these organizations against botnet-assisted attacks.In this project, we aim to devise an adaptive and robust botnet detection and mitigation system that leverages machine learning (ML). We propose novel anomaly-based intrusion detection, employing both host- and network-based detection methods. Each method is strong in detecting some of the essential bot behaviors. Hence, our hybrid detection will leverage the strengths of the underlying methods to build an advanced detection system that bots cannot easily evade. The proposed system will adapt the ML models to network dynamics and adversarial activities, utilizing incremental and adversarial learning, respectively. Upon detection of an intrusion, the system will leverage software-defined networking (SDN) to dynamically adapt the monitoring and surveillance of the network, and instigate root cause analysis. The system will automatically generate mitigation workflows that will be enforced via SDN, to ensure integrity of network and its data.The proposed project will broaden the scope of botnet detection and mitigation, including protection against zero-day threats. Advances made in collaboration with the industry partner, Royal Bank of Canada (RBC), will have a lasting impact on the design principles and practices of cybersecurity for Canadian businesses and financial institutions.